MIRRORS/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2025-10-22 15:03:59 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

hdf5: patch CVE-2025-2914

Browse Source 
Details: https://nvd.nist.gov/vuln/detail/CVE-2025-2914

Pick the patch that is linked in the issue from the nvd report.

Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This commit is contained in:
Gyorgy Sarvari 2025-10-14 16:55:26 +02:00 committed by Khem Raj
parent 5961c0dc6e
commit de5693d6d9
No known key found for this signature in database
GPG Key ID: BB053355919D3314
2 changed files with 48 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
meta-oe/recipes-support/hdf5/files/0001-Refix-of-the-attempts-in-PR-5209-5722.patch Normal file
View File

@ -0,0 +1,47 @@
From 0354419c3b5c6832c994b005903372f156b5fddb Mon Sep 17 00:00:00 2001
From: bmribler <39579120+bmribler@users.noreply.github.com>
Date: Wed, 13 Aug 2025 14:45:41 -0400
Subject: [PATCH] Refix of the attempts in PR-5209 (#5722)
This PR addresses the root cause of the issue by adding a sanity-check immediately
after reading the file space page size from the file.
The same fuzzer in GH-5376 was used to verify that the assert before the vulnerability
had occurred and that an error indicating a corrupted file space page size replaced it.
CVE: CVE-2025-2914
Upstream-Status: Backport [https://github.com/HDFGroup/hdf5/commit/804f3bace997e416917b235dbd3beac3652a8a05]
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
---
src/H5Fsuper.c | 2 ++
src/H5Ofsinfo.c | 3 +++
2 files changed, 5 insertions(+)
diff --git a/src/H5Fsuper.c b/src/H5Fsuper.c
index d9fe3a7..1c8dc6c 100644
--- a/src/H5Fsuper.c
+++ b/src/H5Fsuper.c
@@ -746,6 +746,8 @@ H5F__super_read(H5F_t *f, H5P_genplist_t *fa_plist, bool initial_read)
if (!(flags & H5O_MSG_FLAG_WAS_UNKNOWN)) {
H5O_fsinfo_t fsinfo; /* File space info message from superblock extension */
+ memset(&fsinfo, 0, sizeof(H5O_fsinfo_t));
+
/* f->shared->null_fsm_addr: Whether to drop free-space to the floor */
/* The h5clear tool uses this property to tell the library
* to drop free-space to the floor
diff --git a/src/H5Ofsinfo.c b/src/H5Ofsinfo.c
index 5b69235..2bb6ea6 100644
--- a/src/H5Ofsinfo.c
+++ b/src/H5Ofsinfo.c
@@ -182,6 +182,9 @@ H5O__fsinfo_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU
if (H5_IS_BUFFER_OVERFLOW(p, H5F_sizeof_size(f), p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");
H5F_DECODE_LENGTH(f, p, fsinfo->page_size); /* File space page size */
+ /* Basic sanity check */
+ if (fsinfo->page_size == 0 || fsinfo->page_size > H5F_FILE_SPACE_PAGE_SIZE_MAX)
+ HGOTO_ERROR(H5E_OHDR, H5E_BADVALUE, NULL, "invalid page size in file space info");
if (H5_IS_BUFFER_OVERFLOW(p, 2, p_end))
HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "ran off end of input buffer while decoding");

1
meta-oe/recipes-support/hdf5/hdf5_1.14.6.bb
View File

@ -16,6 +16,7 @@ SRC_URI = "https://support.hdfgroup.org/releases/hdf5/v1_14/v1_14_6/downloads/${
file://0001-cmake-remove-build-flags.patch \
file://0001-Fix-CVE-2025-2153-5795.patch \
file://0001-Fix-CVE-2025-2310-5872.patch \
file://0001-Refix-of-the-attempts-in-PR-5209-5722.patch \
"
SRC_URI[sha256sum] = "e4defbac30f50d64e1556374aa49e574417c9e72c6b1de7a4ff88c4b1bea6e9b"